Some programs accept data from one untrusted user and pass that data
on to a second user; the second user’s application may then process that
data in a way harmful to the second user.
This is a particularly common problem for web applications,
we’ll call this problem “cross-site malicious content.”
In short, you cannot accept input (including any form data)
without checking, filtering, or encoding it.
For more information, see
Section 7.16.

Fundamentally, this means that all web application input must be
filtered (so characters that can cause this problem are removed),
encoded (so the characters that can cause this problem are encoded in
a way to prevent the problem), or
validated (to ensure that only “safe” data gets through).
Filtering and validation should often be done at the input, but
encoding can be done either at input or output time.
If you’re just passing the data through without analysis, it’s probably
better to encode the data on input (so it won’t be forgotten), but
if you’re processing the data, there are arguments for encoding on
output instead.